>Number: 172576
>Category: misc
>Synopsis: librpc segfaults when out of memory
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Oct 10 22:58:22 UTC 2012
>Closed-Date:
>Last-Modified:
>Originator: Ritesh Shah
>Release: 7.2, 8.1, 9.0
>Organization:
>Environment:
7.2-RELEASE-p4 FreeBSD 7.2-RELEASE-p4 #0: Fri Oct 2 08:22:32 UTC 2009
[email protected]:/usr/obj/usr/src/sys/GENERIC amd64
>Description:
xdrrec_create() routine in lib/libc/xdr/xdr_rec.c returns a void. Under low
memory condition this routine can bail out early and leave part of the XDR
structrure uninitialized.
The callers :
clnt_vc_create() in lib/libc/rpc/clnt_vc.c &
makefd_xprt() in lib/libc/rpc/svc_vc.c
do not check whether failed or not.
This can lead to segfault when uninitialized pointers are accessed.
This bug exists in FreeBSD 9 as well.
192 rstrm->in_base = mem_alloc(recvsize);
193 if (rstrm->in_base == NULL) {
194 warnx("xdrrec_create: out of memory");
195 mem_free(rstrm->out_base, sendsize);
196 mem_free(rstrm, sizeof(RECSTREAM));
197 return;
198 }
199 /*
200 * now the rest ...
201 */
202 xdrs->x_ops = &xdrrec_ops;
203 xdrs->x_private = rstrm;
204 rstrm->tcp_handle = tcp_handle;
>How-To-Repeat:
>Fix:
It has been reported against netbsd as well.
http://mail-index.netbsd.org/netbsd-bugs/2012/08/06/msg029375.html
I can provide a patch if there is an agreement on how it should be fixed.
>Release-Note:
>Audit-Trail:
>Unformatted:
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "[email protected]"
